Companies sue Utah to halt law that blocks private gathering, use of such data.

Exactly one year ago in Utah, a Republican state senator introduced a bill that imposed new regulations on how license plate readers (LPRs) could be used in the Beehive State. That bill was signed into law on April 1, 2013.

As Ars has reported before, these scanners, which have been increasingly deployed in cities and towns across the US, can read, analyze, and store 60 plates per second. Typically, the LPR checks an unknown plate against a "hot list" of wanted or stolen vehicles. But the tricky part is that LPRs aren’t just looking for suspected bad guys. They almost always record and retain the time, date, and precise location of every license plate scanned, often for years or longer.

Further Reading

While LPRs are most often used by law enforcement agencies, there are also private firms that engage in such data collection as well, creating their own private database which can be used for repossessing cars. This data can also be shared with law enforcement.

Among other restrictions, the Utah law effectively forbids the private collection of LPR data and stipulates that government agencies can only share it under specific circumstances for a maximum of nine months unless otherwise ordered to by a court.

Two major private LPR firms—Digital Recognition Network and Vigilant Solutions—are suing Utah’s governor and attorney general, arguing that they have a First Amendment right to collect data on license plates, which are displayed in public on open roads.

The case seemingly pits the privacy rights of individuals against the First Amendment rights of corporations to engage in constitutionally protected speech. Legal experts say that this case presents a unique challenge in balancing these two constitutional rights, and it may have implications for future, similar laws across the country.

"Whether such laws are ultimately upheld or ruled unconstitutional will have a huge impact on whether more comprehensive privacy regulations are enacted and what they will look like," Clark Asay, a law professor at Penn State University, told Ars.

"These companies’ dissemination of this type of information would likely be considered at least commercial speech, in which case some First Amendment standards would apply (which the Act may still pass, despite the objections of these companies)," Asay said. "Where it becomes a stretch in my mind is to argue that the First Amendment guarantees that they have the right to collect the information in the first place."

“License plates contain no private information whatsoever”

In the companies' 16-page complaint, which was filed in Utah federal court on Thursday, DRN and Vigilant seek a "permanent injunction against the application or enforcement of the Act." They state that prior to the law’s passage, DRN sold a total of 10 LPR camera kits to five repossession and towing companies operating in Utah; those cameras began operation between May 2010 and February 2012.

The alleged First Amendment violation, the plaintiffs argue, occurs because taking a photograph is constitutionally protected. "The State does not have a substantial interest in preventing persons from viewing or photographing license plates—or from disseminating the information collected when doing so—because license plates contain no private information whatsoever," argue the plaintiffs. "Moreover, the photographic recording of government-mandated public license plates does not infringe any 'privacy' interest that concededly is not infringed when the photographer views the plate. Thus, the State cannot carry its heavy burden to demonstrate that it has a substantial interest that is served by the Act."

"I’m befuddled with that being speech," he told Ars. "As you know, this technology... can cut through fog, it can see in the dark, it’s very invasive—it doesn’t matter if you’re going 80 mph. It’s not just a photograph, it’s the direction of travel, time, and GPS location. If it was just pictures, nobody would buy it. I think it’s an invasion of privacy. This technology is very intrusive, and I don’t think you can argue with a straight face that this is the same thing as taking a picture of a car."

Other legal experts contend that the plaintiffs’ case is likely to succeed because of the language of this specific law.

"The law restricts the collection and use of data with an ‘Automatic license plate reader system,’" Fred Cate, a law professor at Indiana University, told Ars. "The restriction on collecting data might conceivably pass First Amendment scrutiny, but not the ban on using the data. I think it is very likely that a court will strike that down.

"This reminds me of the state limits on collecting and using physician prescribing data," Cate said. "As those laws spread, many people just assumed they were constitutional, until [2011, when] the Supreme Court in Sorrell v. IMS Health said the laws were unconstitutional. One of the key points the Court made is that states are not free to favor some speakers or some uses of data over others. That is exactly what the Utah license plate law does by permitting a handful of uses and outlawing all others. The case for invalidating laws restricting the collection and use of license plate data is even stronger since the data is visible and is collected in public."

Further Reading

Asay disagrees. "I don’t think Sorrell v. IMS Health Inc. helps these companies much, because that was a commercial speech case striking down a Vermont statute on the basis of restricting disclosure or use of certain pharmacy records for marketing purposes," the Penn State law professor told Ars. "So the statute didn’t technically bar collection of the information in the records, just the use and disclosure of them for marketing purposes. There is also other state case law that upheld the constitutionality of state statutes that restricted access to certain information if that information were to be used for commercial purposes."

"One major difference here is that all of this information is publicly available," Asay said. "And so that is likely to be a distinction that people against such regulations will point to in making the case, essentially, that this is publicly available information that we are allowed to collect and disseminate. But again, I think that argument fails. There are a number of statutes—the Video Voyeurism Act and California’s Anti-Paparazzi laws, to name a few—that make illegal collecting certain types of information, even in public places. As far as I know, such laws have been held constitutional."

However, State Sen. Weiler also told Ars that he’s currently working with the American Civil Liberties Union of Utah to make a revision to his law, which he says "may negate" this lawsuit.

"I’m opening a bill file today," he said, but he added that he may not be successful given that the current Utah legislative session ends in mid-March.

This is ridiculous. This isn't a First Amendment issue. Data sharing isn't free expression.These are the same people who (successfully) tried to argue that campaign finance can't be limited because throwing cash at politicians is somehow also "free speech."

"Publicly available" != "data warehouse for anyone with questionable ethics and the means to tap into."

Yes, the license plates contain no private data, but single plate collection is not the issue. It's the mass collection and storage. It's a new ability with existing data, and it is absolutely significant. Just ask the RIAA.

the insane notion that the legal fiction of 'corporations as persons' supersedes the rights of real live human beings needs to be reined it. Yes, corps must operate with that legal fiction - no, that should never trump the rights of any living. breathing, individual who has a pulse.

This is ridiculous. This isn't a First Amendment issue. Data sharing isn't free expression.These are the same people who (successfully) tried to argue that campaign finance can't be limited because throwing cash at politicians is somehow also "free speech."

Are you sure? Reread the article. The republican is the one who pushed for limits on licence plate photos

I'm not talking about Republicans. I'm talking about people who twist "free speech" into this bizarre Orwellian nightmare. Democrats like unlimited campaign finance, too.

This is ridiculous. This isn't a First Amendment issue. Data sharing isn't free expression.These are the same people who (successfully) tried to argue that campaign finance can't be limited because throwing cash at politicians is somehow also "free speech."

Are you sure? Reread the article. The republican is the one who pushed for limits on licence plate photos

I thought it was big corps that argued that point, which is the same people here doing so.

Miller: A lot o' people don't realize what's really going on. They view life as a bunch o' unconnected incidents 'n things. They don't realize that there's this, like, lattice o' coincidence that lays on top o' everything. Give you an example; show you what I mean: suppose you're thinkin' about a plate o' shrimp. Suddenly someone'll say, like, plate, or shrimp, or plate o' shrimp out of the blue, no explanation. No point in lookin' for one, either. It's all part of a cosmic unconsciousness.

This is ridiculous. The First Amendment doesn't have any kind of justification for data collection. Data sharing isn't free expression.

That is an overly-broad position to take. There is tons of free expression that is falls under the umbrella of "data sharing". For example, such an interpretation would allow government suppression of scientists from releasing studies of general population for political reasons, among other things.

If this is protected speech, I don't see how the laws governing credit reporting and monitoring can pass muster either. In that case you are willing providing information to one entity (a store, a credit card processing service). Wouldn't the "free speech" argument also apply to their ability to share the data with other companies? All the credit monitoring companies do is aggregate that legally obtained information and then provide it to their clients. We have decided that, because their business affects the privacy and well-being of people, there should be restrictions on what they can record, how they can share it, and whether they can keep it secret from the people it describes.

This is ridiculous. The First Amendment doesn't have any kind of justification for data collection. Data sharing isn't free expression.

That is an overly-broad position to take. There is tons of free expression that is falls under the umbrella of "data sharing". For example, such an interpretation would allow government suppression of scientists from releasing studies of general population for political reasons, among other things.

There are actually tons of regulations on what kind of data collection can be done for research purposes, specifically because it can impinge on the subjects privacy. In particular, data anonymity needs to be part of the process, in that during data collection and analysis identifying data (data that could be used to track back the conclusions to specific people) must be scrubbed or replaced with anonymizing data in order for the research to pass ethics board approval. The fact that these companies are storing non-anonymized data is the biggest concern I would suspect. I'm pretty sure they don't have an overseeing ethics board.

It makes sense to me. You don't ban each instance of unethical aggregate data usage, you go after the data aggregation to prevent it from happening in the first place. Too bad no one is doing this to the NSA.

The alleged First Amendment violation, the plaintiffs argue, occurs because taking a photograph is constitutionally protected. "The State does not have a substantial interest in preventing persons from viewing or photographing license plates—or from disseminating the information collected when doing so—because license plates contain no private information whatsoever,"

And I have a First Amendment right to follow, photograph, geotag, and twitter every move that the owners of DRN/Vigilant, their spouses and children make in public.

I'm generally in favor of personal privacy, but I don't see how the law would hold up. The state seems to be relying on the 'automated' piece, so would it be ok if the scanners fed the video into a recaptcha and had people type in the plates? Or fed it to Mechanical Turk?

I generally side with privacy advocates, but I don't see how there's any expectation of privacy when operating a registered motor vehicle on a public road.

There is a problem with this though. I encountered and engaged a person who was operating a private vehicle with these scanners here in MD. They were driving trough parking lots. I trapped one in a lot's dead-end and asked some questions. They were tight lipped, but answered some of my questions. And I concluded that it was likely a repo company.

However, I was also immediately horrified because here there is no law on the retention of the data. Also, the car was scanning private lots, which is trespassing. Therefore, the data obtained in a lot would not normally be legally available. Public roadways and park and rides are one thing. But driving through ungated private lots is another.

What you get here is then a situation where the state can buy information from this 3rd party that has the scanner database and violate by proxy a person's right to privacy.

The alleged First Amendment violation, the plaintiffs argue, occurs because taking a photograph is constitutionally protected

Is this true? In th e years after 9/11, guards in front of various buildings, governmental and private, would shoo-away or intimidate tourists (especially those of the brown persuasion) taking pictures of the buildings. I don't recall any 1st amendment claims being raised then.

the insane notion that the legal fiction of 'corporations as persons' supersedes the rights of real live human beings needs to be reined it. Yes, corps must operate with that legal fiction - no, that should never trump the rights of any living. breathing, individual who has a pulse.

I think that is a red herring in this case. The reason that surveillance has become such a big concern lately is because it has become so affordable that even an individual can do it. A single person could afford to buy several license plate scanners, set them up around the city. Or spread Wifi monitors to track smartphones, and then use that tracking information for all sorts of harmful purposes. Is it any better for that individual to do so than for a corporation? If an act is harmful then it should be banned for everyone.

And everyone should have redress when/if the government is overstepping it's bounds. These issues and the precedents they set affect all of us should be weighed on their merits, not who happens to to be the plaintiff or defendant in any particular case.

And besides it's not like this is about some huge mega corporation. It is a small tech company selling its wares to other small repo companies.

The alleged First Amendment violation, the plaintiffs argue, occurs because taking a photograph is constitutionally protected

Is this true? After 9/11, rent-a-cops in front of various buildings, governmental and private, would shoo-away or intimidate tourists (especially those of the brown persuasion) taking pictures of the buildings. I don't recall any 1st amendment claims being raised then.

I think this is actually a symptom of a larger problem. That problem is business of tracking and profiling citizens by private enterprises for money.

Tracking license plates is just one more dot on this flood of information. The credit bureaus track us. There are plenty of other bureaus that also track us. For example, most large cities have has a landlord association that tracks tenant, so that if you are late or evicted, every landlord in town knows.

There are companies that are now trying to profile you based on your social network activity and connections.

Telcos track where you are via your mobile phone. They also track who you call.

ISP's can track what sites you visit.

Retail stores track when you have entered their store from your mobile phone. Some are even tracking your path in the store, and matching that to purchases, the same way websites uses Google Analytics to watch your path through their site to a purchase decision.

Tomorrow, who knows what metrics and datapoints they want to collect. What if they can match your car based on the noise footprint it makes as it goes past because they are banned from reading license plates? You know this works. Dogs do it all the time. Do you ever notice how dogs can hear your specific car coming up the street? How long before someone figures out how to simulate the same with a computer and good microphone? It won't take long for them to build a nice travel pattern profile of specific cars.

I feel that any law that addresses this issue needs to do it at a level above the specific information, or technology. It must clearly delineate what is private, what is non shareable, and what is public. We have already done this for medical information (HIPAA). Why can't we do the same for our financial records, travel information, shopping, and media consumption?

Honestly I don't see what expectation of privacy you have driving a car on a public road, nor how you should be able to tell other people they can't talk about it.

Just because watching or photographing a specific car on a specific road at a specific time is legal, doesn't (or should not) mean that tracking the precise location (via GPS) of every car on that road, at all times, and stored in databases that can be cross-references is automatically also legal. The two situations are very different in their scope (the breadth of data collection) and invasiveness (the amount of data collected).

There is a concept of "reasonable search", and it's not a stretch to think that the same concept could be extended to the gathering of data from public places.

It seems to me that there is little distance down the slippery slope between this and blanketing public streets with cameras to track and record an individuals movements. It may all be moot in the future, anyways, as cars become more and more connected to data networks, and the location of your car is already stored in some data warehouse.

The alleged First Amendment violation, the plaintiffs argue, occurs because taking a photograph is constitutionally protected

Is this true? In th e years after 9/11, guards in front of various buildings, governmental and private, would shoo-away or intimidate tourists (especially those of the brown persuasion) taking pictures of the buildings. I don't recall any 1st amendment claims being raised then.

There were lots of claims and complaints, but the general public didn't care about them, because "terrorism."

I'm generally in favor of personal privacy, but I don't see how the law would hold up. The state seems to be relying on the 'automated' piece, so would it be ok if the scanners fed the video into a recaptcha and had people type in the plates? Or fed it to Mechanical Turk?

Yes. This difference is pretty important. I think (citation required) that the automated capture was an important point about covert GPS surveillance by the FBI. That is, it is easier to get bulk data on a greater population without the resource requirements that having an actual person follow the target to collect information on their location and activities. This could be an important point in this case.

This is ridiculous. This isn't a First Amendment issue. Data sharing isn't free expression.

What is freedom of press exactly? Sharing words that aren't data?

Honestly I don't see what expectation of privacy you have driving a car on a public road, nor how you should be able to tell other people they can't talk about it.

The law doesn't prohibit them from sharing it (which might be a First Amendment issue), it prevents them from collecting it. The expectation of privacy pertains to the government's requirements to execute a search.

This is ridiculous. The First Amendment doesn't have any kind of justification for data collection. Data sharing isn't free expression.

That is an overly-broad position to take. There is tons of free expression that is falls under the umbrella of "data sharing". For example, such an interpretation would allow government suppression of scientists from releasing studies of general population for political reasons, among other things.

There are actually tons of regulations on what kind of data collection can be done for research purposes, specifically because it can impinge on the subjects privacy. In particular, data anonymity needs to be part of the process, in that during data collection and analysis identifying data (data that could be used to track back the conclusions to specific people) must be scrubbed or replaced with anonymizing data in order for the research to pass ethics board approval. The fact that these companies are storing non-anonymized data is the biggest concern I would suspect. I'm pretty sure they don't have an overseeing ethics board.

Well those aren't laws (beyond stuff like HIPPA that everyone has to follow), rather rules imposed by the research organization or funding source (including the government).

But more to the point, these rules recognize that there are trade-offs here. The research needs to be done, and privacy needs to be protected. If an administration pushed NIH to take an extreme view like Geronimous espoused, that it can limit the data collection and sharing of scientists however they wished and that Free Speech had no bearing on the matter, then they would be slapped down by the courts and rightfully so.

I'm just tired seeing shallow hyperbole being the most highly rated comments on this site.

The problem with the "it's public data" argument is that it's more than a piece of public information. It is not like taking a photograph of a license plate because what they are actually doing is taking lots of photographs using different scanners at different places and times that are rendered into data that can be connected to lots of databases that creates a profile that's a gross invasion of privacy. That's what the technology has made possible.

Alito (Jones case, 2012): "In the pre-computer age, the greatest protections of privacy were neither constitutional nor statutory, but practical. Traditional surveillance for any extended period of time was difficult and costly and therefore rarely undertaken....Devices like the one used in the present case, however, make long-term monitoring relatively easy and cheap. In circumstances involving dramatic technological change, the best solution to privacy concerns may be legislative."

SCOTUS already decided the government can't do it using GPS to collect information about public actions over an extended period of time because it violates the 4th Amendment. Now it it may be that the there are no laws to prevent private companies doing this now but do we really want them doing it any more than government (who they want to share the data with anyway)? The problem is bigger than license plates. Big data is sucking up everything. If we have no restrictions to protect us from government and private companies' data collection activities, we have no freedom.

The alleged First Amendment violation, the plaintiffs argue, occurs because taking a photograph is constitutionally protected

Is this true? After 9/11, rent-a-cops in front of various buildings, governmental and private, would shoo-away or intimidate tourists (especially those of the brown persuasion) taking pictures of the buildings. I don't recall any 1st amendment claims being raised then.

And I have a First Amendment right to follow, photograph, geotag, and twitter every move that the owners of DRN/Vigilant, their spouses and children make in public.

Er, no, wait...that's called stalking.

Putting aside the point about "stalking" for a moment.

Even if you had the unquestioned "right to follow, photograph, geotage, and twitter every move that the owners of DRN/Vigilant their spouses and children make in public", chances are you do not have the financial resources to do so.

And there exists an imbalance of power...

PS -- 101st post! I've been promoted from "Smak-fu Master, In Training" to "Wise, Aged Ars Veteran". Although I'm not sure about the "wise" part.

IMO Liscence plates are detailed requirement of state law. They are actually property of the state. Because this is so,the state has the responsibility of administering information pertaining to them. That information cannot make a security vulnerability - either described or as statistic (such as detailing who you voted for,where you live,where you work,who your family members are etc. ..security information that is in the control of the holder) to the person described by it. Shortly the state is responsible for the information detailed and collected by their own laws. That it is not vulnerable to unlawful use . As privacy violation.

Honestly I don't see what expectation of privacy you have driving a car on a public road, nor how you should be able to tell other people they can't talk about it.

Just because watching or photographing a specific car on a specific road at a specific time is legal, doesn't (or should not) mean that tracking the precise location (via GPS) of every car on that road, at all times, and stored in databases that can be cross-references is also legal, because the two situations are very different in their scope (the breadth of data collection) and invasiveness (the amount of data collected).

There is a concept of "reasonable search", and it's not a stretch to think that the same concept could be extended to the gathering of data from public places.

The 4th Amendment restrictions on "reasonable search" only apply to government, so "stretching" it to a private party exceeds Constitutional authority.

To the initial argument, while I am strong proponent of privacy rights the idea that something that is completely legal becomes illegal once you do it some arbitrary x amount of times is a tricky prospect. You cannot simultaneously say that people have no expectation of privacy in a public space (which is the current standard) while also saying that recording too much of their public activity is violating their privacy. If none of the individual actions are private, how can you say that the aggregate of them is private? Moreover, how do you draw the line and say "this specific amount of public activity is where you cross the line into private" without being completely arbitrary?

If we are going to say as a society that this aggregate data is private because of what it reveals, it is probably time to revist the core concept of what actions we consider private and build from there rather than drawing arbitrary lines on shaky logical reasoning because something makes us uncomfortable.

OK, let's start with my dislike of people tracking me. I don't like it.

Still - As long as the government can track private citizens using automated LPRs, then private citizens and corporations can do the same. I strongly disagree with the government having special exemptions over the people they serve.

The question in my mind isn't whether or not a company collects this data from a public roadway, The question is "how" it is used. I have no problem with a repo company using this to look for cars they are tasked to bring in. I don't have a problem with a private company which has had "problems" from using this to head off issues (maybe by flagging the plates for aggressive protesters).

The point isn't that they collected it. My problem is with the long term storage of the data and the resale of it for use outside of the company.

I don't care that my cell carrier tracks my movements if they use the data to improve my coverage and plan. I do care if they sell my data to a 3rd party (read government). Government should get a warrant.

I don't think you can really argue this solely based on any specific technology -- since, as others have mentioned, you could collect the same data manually, just far less efficiently. Improving technology and algorithms will make all this and more cheaper and easier. (Though, really, how hard would it be for most Ars readers to build something like this for personal use? A system that would scan all the cars around you and let you track and analyze their behavior over the course of regular commutes.)

I think you'd have to argue that the aggregate commercial use of license-plate readers, cell phone scanners, private facial-recognition systems would become equivalent to stalking or loss of privacy. (There's nothing stopping one of these repo firms from sharing their database with, say, private detectives -- or anyone else.)